CVE-2026-56124

Name of the Vulnerable Software and Affected Versions phpUploader versions prior to 2.0.2

Description An unauthenticated information disclosure exists where remote attackers can access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block. This exposes sensitive data including uploader IP addresses, Argon2ID key hashes (a secure password hashing algorithm), internal filenames, and SHA-256 fingerprints.

Recommendations Update phpUploader to version 2.0.2 or later.